-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: s390x
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: s390x Build Daemon (ziehrer) <buildd_s390x-ziehrer@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 a7ea0bc1a1d6a3888f9b7a9697caa1054722b714 485028 cockpit-ws-dbgsym_337-1+deb13u2_s390x.deb
 53dd8fcc389f106f59948fef01e20b63f07711e5 1026712 cockpit-ws_337-1+deb13u2_s390x.deb
 d1ab85e2d663cf8efccc7e40b3d9c28d2e2d674b 11447 cockpit_337-1+deb13u2_s390x-buildd.buildinfo
Checksums-Sha256:
 d5d6280bba2858c95505e6f2c47cd44680f991dd8d2eb16b1e5b4f2407c9ca9c 485028 cockpit-ws-dbgsym_337-1+deb13u2_s390x.deb
 620e91e2459bc1a6db03d755be440a51820a53868e846a90c0d29b9161055e47 1026712 cockpit-ws_337-1+deb13u2_s390x.deb
 055a8f99a441b061f2d587f4a1f46fbca7fd42ec107dd963ada87a06a32eeb27 11447 cockpit_337-1+deb13u2_s390x-buildd.buildinfo
Files:
 f35bedc78b64ff92c116ad6ebd4c7616 485028 debug optional cockpit-ws-dbgsym_337-1+deb13u2_s390x.deb
 23bc547375bbc9e744641e3411e1bc76 1026712 admin optional cockpit-ws_337-1+deb13u2_s390x.deb
 9c5a77f01c9d7d308eb53b7d4ed527f5 11447 admin optional cockpit_337-1+deb13u2_s390x-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmqP3WgACgkQMWUFebkH
noSUhw//QPg4IgzOSexavnup0LYeDotz6Svra9ohDcuOjm0ZOdNUBpB1f+C18dBX
s+s9YO3Rxv0s90X2bOoV8CKau1le80xwySBP9I8eEGzTJQWP7BEs/mNCOF/kMcFH
AUfbn3lqGr0dSjrcg9EW8uezNddec7+vM6Ilt17zGyWAWHPMsugHdIMphG/B9axG
9GK597HQO9YfLWuLhOtDtyplZVXUTjYNtP1clA2tzV0LGvHoerK73eGENXNy0G+B
Y0AdTwhvDjqSh26Eir9kRGfuxIWkpQtJ5ykIQouddIlozq7Z5sjNL26N2gDlxLc2
Unyn7dT2iXT4WJkTMRlcDq9eBZYBQVymRdIaRfjoh1ZXktjL1Fr3W0DpbClsdOjx
c+JqYkZRtN3GLeq+3zfwpWhMOJpMVXwzSCSd0SEtcY1dKZO1BRDlYob3gT1QRr/M
e89Cx7v/bEwFMcOHYkyKNu1eERnR/iiuN0V47k/gqghFFrhy2pjo2FwwPw/gcoWG
VIrxpwvbwCzxO2Kyvg6X5tzBfJmVC3aLK5ad9NFRDXQgwiyC5lAEI1x7xRXbd7Ru
82urvCOJtpLpMMKzIGGqUmbv975OxvQTHoSTkJS1dml1v6kI347WFhg1FX6XfjmZ
uZglsUrUTON3SYPqxwJEU74soz2KKdAEXYbHRGeDx7Nw88ar0dY=
=Luus
-----END PGP SIGNATURE-----